Skip to content

Commit 0ee43c8

Browse files
dipti-paidipti-pai
committed
[RFC-007] Implement GitHub app authentication for git repositories in IAC
- Controller change to use the GitHub authentication information specified in Git Repository's `.spec.secretRef` to create the auth options to authenticate to git repositories when the `provider` field is set to `github`, - Tests for new `github` provider field in IAC - Updated docs to use GitHub Apps for authentication in image-automation-controller. Signed-off-by: Dipti Pai <[email protected]>
1 parent ebeead0 commit 0ee43c8

File tree

5 files changed

+69
-16
lines changed

5 files changed

+69
-16
lines changed

‎docs/spec/v1beta2/imageupdateautomations.md

+7
Original file line numberDiff line numberDiff line change
@@ -257,6 +257,13 @@ patches:
257257
azure.workload.identity/use: "true"
258258
```
259259

260+
##### GitHub
261+
262+
If the provider is set to `github`, make sure the GitHub App is registered and
263+
installed with the necessary permissions and the github app secret is configured
264+
as described
265+
[here](https://fluxcd.io/flux/components/source/gitrepositories/#github).
266+
260267
### Git specification
261268

262269
`.spec.git` is a required field to specify Git configurations related to source

‎go.mod

+12
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ require (
5656
github.com/Microsoft/go-winio v0.6.1 // indirect
5757
github.com/beorn7/perks v1.0.1 // indirect
5858
github.com/blang/semver/v4 v4.0.0 // indirect
59+
github.com/bradleyfalzon/ghinstallation/v2 v2.11.0 // indirect
5960
github.com/cespare/xxhash/v2 v2.3.0 // indirect
6061
github.com/chai2010/gettext-go v1.0.2 // indirect
6162
github.com/cloudflare/circl v1.4.0 // indirect
@@ -77,12 +78,15 @@ require (
7778
github.com/go-openapi/swag v0.23.0 // indirect
7879
github.com/gofrs/uuid v4.4.0+incompatible // indirect
7980
github.com/gogo/protobuf v1.3.2 // indirect
81+
github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
8082
github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
8183
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
8284
github.com/golang/protobuf v1.5.4 // indirect
8385
github.com/google/btree v1.1.2 // indirect
8486
github.com/google/gnostic-models v0.6.8 // indirect
8587
github.com/google/go-cmp v0.6.0 // indirect
88+
github.com/google/go-github/v62 v62.0.0 // indirect
89+
github.com/google/go-querystring v1.1.0 // indirect
8690
github.com/google/gofuzz v1.2.0 // indirect
8791
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
8892
github.com/google/uuid v1.6.0 // indirect
@@ -160,3 +164,11 @@ require (
160164
sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
161165
sigs.k8s.io/yaml v1.4.0 // indirect
162166
)
167+
168+
replace github.com/fluxcd/source-controller/api => github.com/dipti-pai/source-controller/api v0.0.0-20241022192612-2ada07176114
169+
170+
replace github.com/fluxcd/pkg/auth => github.com/dipti-pai/pkg/auth v0.0.0-20241024052802-53e4364eab6a
171+
172+
replace github.com/fluxcd/pkg/git => github.com/dipti-pai/pkg/git v0.0.0-20241024052802-53e4364eab6a
173+
174+
replace github.com/fluxcd/pkg/git/gogit => github.com/dipti-pai/pkg/git/gogit v0.0.0-20241024052802-53e4364eab6a

‎go.sum

+17-8
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
3333
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
3434
github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
3535
github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
36+
github.com/bradleyfalzon/ghinstallation/v2 v2.11.0 h1:R9d0v+iobRHSaE4wKUnXFiZp53AL4ED5MzgEMwGTZag=
37+
github.com/bradleyfalzon/ghinstallation/v2 v2.11.0/go.mod h1:0LWKQwOHewXO/1acI6TtyE0Xc4ObDb2rFN7eHBAG71M=
3638
github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
3739
github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
3840
github.com/chai2010/gettext-go v1.0.2 h1:1Lwwip6Q2QGsAdl/ZKPCwTe9fe0CjlUbqj5bFNSjIRk=
@@ -48,6 +50,14 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
4850
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
4951
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
5052
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
53+
github.com/dipti-pai/pkg/auth v0.0.0-20241024052802-53e4364eab6a h1:Eenqwbr8LyA3PwAvCouhoOHx3065IU3w2GlaLwUHYMQ=
54+
github.com/dipti-pai/pkg/auth v0.0.0-20241024052802-53e4364eab6a/go.mod h1:sVEQPJ2wMYr6VgW7Xphy8gci1PsmWvJR1Y1MowePSRM=
55+
github.com/dipti-pai/pkg/git v0.0.0-20241024052802-53e4364eab6a h1:FKZ3ovA+exjX7JXtPIKXlOnzN6S7GXe2r+vvuQ8pJ7A=
56+
github.com/dipti-pai/pkg/git v0.0.0-20241024052802-53e4364eab6a/go.mod h1:QAX8mZHYlAmcMwPXsx4x3WC20J4FFQjeigp3CPZJQ8I=
57+
github.com/dipti-pai/pkg/git/gogit v0.0.0-20241024052802-53e4364eab6a h1:FPRtQw4zhFRqxz0wfX1MFgF/svtYtHJ0h3a7icRXtF4=
58+
github.com/dipti-pai/pkg/git/gogit v0.0.0-20241024052802-53e4364eab6a/go.mod h1:1Jrqq3A9tAQUGYa4fA4Jc2t54z8rtdHB/5Ge0Q3bIQg=
59+
github.com/dipti-pai/source-controller/api v0.0.0-20241022192612-2ada07176114 h1:xcIQZXx5PvFmEMAPPnI7v6kRYeYzvFoYQVaFFxBewwc=
60+
github.com/dipti-pai/source-controller/api v0.0.0-20241022192612-2ada07176114/go.mod h1:gSjg57T+IG66SsBR0aquv+DFrm4YyBNpKIJVDnu3Ya8=
5161
github.com/elazarl/goproxy v0.0.0-20240909085733-6741dbfc16a1 h1:g7YUigN4dW2+zpdusdTTghZ+5Py3BaUMAStvL8Nk+FY=
5262
github.com/elazarl/goproxy v0.0.0-20240909085733-6741dbfc16a1/go.mod h1:thX175TtLTzLj3p7N/Q9IiKZ7NF+p72cvL91emV0hzo=
5363
github.com/emicklei/go-restful/v3 v3.12.1 h1:PJMDIM/ak7btuL8Ex0iYET9hxM3CI2sjZtzpL63nKAU=
@@ -74,12 +84,6 @@ github.com/fluxcd/pkg/apis/event v0.10.1 h1:3PIAWOtEWblw7R2NUiEMFahRLs3cyYWXQpsM
7484
github.com/fluxcd/pkg/apis/event v0.10.1/go.mod h1:MuOoVHW27i0KOoEEerSOg49VdUy4etKc3thbQIeXAmg=
7585
github.com/fluxcd/pkg/apis/meta v1.6.1 h1:maLhcRJ3P/70ArLCY/LF/YovkxXbX+6sTWZwZQBeNq0=
7686
github.com/fluxcd/pkg/apis/meta v1.6.1/go.mod h1:YndB/gxgGZmKfqpAfFxyCDNFJFP0ikpeJzs66jwq280=
77-
github.com/fluxcd/pkg/auth v0.0.1 h1:3fMg1EdkQdY2Rv1qHbiPPWCBa27xsNeu09y9SuZk6Co=
78-
github.com/fluxcd/pkg/auth v0.0.1/go.mod h1:tdCkiB3/LBg7CcxX1fhVmM5ZjDIaOduK0XX88pBXie0=
79-
github.com/fluxcd/pkg/git v0.21.0 h1:5FfcKj9bDVz8KwoOQUOSJABLMeSdhvLBf7yctwwuMzc=
80-
github.com/fluxcd/pkg/git v0.21.0/go.mod h1:iCCmUCunoFLgntySJfIDxsHGYfS97ky990gEKIDZ9lo=
81-
github.com/fluxcd/pkg/git/gogit v0.21.0 h1:iR2kzW1XrcBDYuC8zVIAdC/2/aeXuRkZ9jupdd54E6I=
82-
github.com/fluxcd/pkg/git/gogit v0.21.0/go.mod h1:gyoSlEIqzsOiTwSL0iFuEiJat+W0uGgc+WEiCVC1xk8=
8387
github.com/fluxcd/pkg/gittestserver v0.13.1 h1:5rXF8ANlk6wtAsvqH7tI7gaO2zhMySftf7ALh0AhfU4=
8488
github.com/fluxcd/pkg/gittestserver v0.13.1/go.mod h1:nPO7ibtBRgLWFHTSvxI63zZubJXU82cVMH6nViVnHsY=
8589
github.com/fluxcd/pkg/runtime v0.49.1 h1:Xyruu1VvkaKZaAhm/32tHJnHab9aU3HzZCf+w6Xoq2A=
@@ -88,8 +92,6 @@ github.com/fluxcd/pkg/ssh v0.14.1 h1:C/RBDch6cxAqQtaOohcasSAeGfZznNEeZtvpfI+hXQY
8892
github.com/fluxcd/pkg/ssh v0.14.1/go.mod h1:HsVzHyF7CkfTnjtLEI6XK+8tfyWqwI1TPxJ34HcMg2o=
8993
github.com/fluxcd/pkg/version v0.4.1 h1:xnw+cu+GRcQSBTejcGiigYpipszO4Cn5UUGpAHVN4F0=
9094
github.com/fluxcd/pkg/version v0.4.1/go.mod h1:hO3ul44vTFFrosekcnrpxoPaM4cLbET4Fc/LR6pz4YQ=
91-
github.com/fluxcd/source-controller/api v1.4.1 h1:zV01D7xzHOXWbYXr36lXHWWYS7POARsjLt61Nbh3kVY=
92-
github.com/fluxcd/source-controller/api v1.4.1/go.mod h1:gSjg57T+IG66SsBR0aquv+DFrm4YyBNpKIJVDnu3Ya8=
9395
github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
9496
github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
9597
github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
@@ -124,6 +126,8 @@ github.com/gofrs/uuid v4.4.0+incompatible h1:3qXRTX8/NbyulANqlc0lchS1gqAVxRgsuW1
124126
github.com/gofrs/uuid v4.4.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
125127
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
126128
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
129+
github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
130+
github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
127131
github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
128132
github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
129133
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
@@ -134,11 +138,16 @@ github.com/google/btree v1.1.2 h1:xf4v41cLI2Z6FxbKm+8Bu+m8ifhj15JuZ9sa0jZCMUU=
134138
github.com/google/btree v1.1.2/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
135139
github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
136140
github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
141+
github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
137142
github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
138143
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
139144
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
140145
github.com/google/go-containerregistry v0.20.2 h1:B1wPJ1SN/S7pB+ZAimcciVD+r+yV/l/DSArMxlbwseo=
141146
github.com/google/go-containerregistry v0.20.2/go.mod h1:z38EKdKh4h7IP2gSfUUqEvalZBqs6AoLeWfUy34nQC8=
147+
github.com/google/go-github/v62 v62.0.0 h1:/6mGCaRywZz9MuHyw9gD1CwsbmBX8GWsbFkwMmHdhl4=
148+
github.com/google/go-github/v62 v62.0.0/go.mod h1:EMxeUqGJq2xRu9DYBMwel/mr7kZrzUOfQmmpYrZn2a4=
149+
github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
150+
github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
142151
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
143152
github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
144153
github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=

‎internal/source/git.go

+20-7
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ import (
3232
"sigs.k8s.io/controller-runtime/pkg/client"
3333

3434
"github.com/fluxcd/pkg/auth/azure"
35+
"github.com/fluxcd/pkg/auth/github"
3536
"github.com/fluxcd/pkg/git"
3637
"github.com/fluxcd/pkg/git/gogit"
3738
sourcev1 "github.com/fluxcd/source-controller/api/v1"
@@ -162,13 +163,15 @@ func configurePush(cfg *gitSrcCfg, gitSpec *imagev1.GitSpec, checkoutRef *source
162163
}
163164

164165
func getAuthOpts(ctx context.Context, c client.Client, repo *sourcev1.GitRepository) (*git.AuthOptions, error) {
166+
var authSecret corev1.Secret
165167
var data map[string][]byte
166168
var err error
167169
if repo.Spec.SecretRef != nil {
168-
data, err = getSecretData(ctx, c, repo.Spec.SecretRef.Name, repo.GetNamespace())
170+
authSecret, err = getSecret(ctx, c, repo.Spec.SecretRef.Name, repo.GetNamespace())
169171
if err != nil {
170172
return nil, fmt.Errorf("failed to get auth secret '%s/%s': %w", repo.GetNamespace(), repo.Spec.SecretRef.Name, err)
171173
}
174+
data = authSecret.Data
172175
}
173176

174177
u, err := url.Parse(repo.Spec.URL)
@@ -181,13 +184,21 @@ func getAuthOpts(ctx context.Context, c client.Client, repo *sourcev1.GitReposit
181184
return nil, fmt.Errorf("failed to configure authentication options: %w", err)
182185
}
183186

184-
if repo.GetProvider() == sourcev1.GitProviderAzure {
187+
switch repo.GetProvider() {
188+
case sourcev1.GitProviderAzure:
185189
opts.ProviderOpts = &git.ProviderOptions{
186190
Name: sourcev1.GitProviderAzure,
187191
AzureOpts: []azure.OptFunc{
188192
azure.WithAzureDevOpsScope(),
189193
},
190194
}
195+
case sourcev1.GitProviderGitHub:
196+
opts.ProviderOpts = &git.ProviderOptions{
197+
Name: sourcev1.GitProviderGitHub,
198+
GitHubOpts: []github.OptFunc{
199+
github.WithSecret(authSecret),
200+
},
201+
}
191202
}
192203

193204
return opts, nil
@@ -199,10 +210,11 @@ func getProxyOpts(ctx context.Context, c client.Client, repo *sourcev1.GitReposi
199210
}
200211
name := repo.Spec.ProxySecretRef.Name
201212
namespace := repo.GetNamespace()
202-
proxyData, err := getSecretData(ctx, c, name, namespace)
213+
proxySecret, err := getSecret(ctx, c, name, namespace)
203214
if err != nil {
204215
return nil, fmt.Errorf("failed to get proxy secret '%s/%s': %w", namespace, name, err)
205216
}
217+
proxyData := proxySecret.Data
206218
address, ok := proxyData["address"]
207219
if !ok {
208220
return nil, fmt.Errorf("invalid proxy secret '%s/%s': key 'address' is missing", namespace, name)
@@ -218,11 +230,12 @@ func getProxyOpts(ctx context.Context, c client.Client, repo *sourcev1.GitReposi
218230

219231
func getSigningEntity(ctx context.Context, c client.Client, namespace string, gitSpec *imagev1.GitSpec) (*openpgp.Entity, error) {
220232
secretName := gitSpec.Commit.SigningKey.SecretRef.Name
221-
secretData, err := getSecretData(ctx, c, secretName, namespace)
233+
secret, err := getSecret(ctx, c, secretName, namespace)
222234
if err != nil {
223235
return nil, fmt.Errorf("could not find signing key secret '%s': %w", secretName, err)
224236
}
225237

238+
secretData := secret.Data
226239
data, ok := secretData[signingSecretKey]
227240
if !ok {
228241
return nil, fmt.Errorf("signing key secret '%s' does not contain a 'git.asc' key", secretName)
@@ -251,14 +264,14 @@ func getSigningEntity(ctx context.Context, c client.Client, namespace string, gi
251264
return entity, nil
252265
}
253266

254-
func getSecretData(ctx context.Context, c client.Client, name, namespace string) (map[string][]byte, error) {
267+
func getSecret(ctx context.Context, c client.Client, name, namespace string) (corev1.Secret, error) {
255268
key := types.NamespacedName{
256269
Namespace: namespace,
257270
Name: name,
258271
}
259272
var secret corev1.Secret
260273
if err := c.Get(ctx, key, &secret); err != nil {
261-
return nil, err
274+
return secret, err
262275
}
263-
return secret.Data, nil
276+
return secret, nil
264277
}

‎internal/source/git_test.go

+13-1
Original file line numberDiff line numberDiff line change
@@ -141,24 +141,36 @@ func Test_getAuthOpts(t *testing.T) {
141141
func Test_getAuthOpts_providerAuth(t *testing.T) {
142142
tests := []struct {
143143
name string
144+
url string
144145
beforeFunc func(obj *sourcev1.GitRepository)
145146
wantProviderOptsName string
146147
}{
147148
{
148149
name: "azure provider",
150+
url: "https://dev.azure.com/foo/bar/_git/baz",
149151
beforeFunc: func(obj *sourcev1.GitRepository) {
150152
obj.Spec.Provider = sourcev1.GitProviderAzure
151153
},
152154
wantProviderOptsName: sourcev1.GitProviderAzure,
153155
},
156+
{
157+
name: "github provider",
158+
url: "https://github.com/org/repo.git",
159+
beforeFunc: func(obj *sourcev1.GitRepository) {
160+
obj.Spec.Provider = sourcev1.GitProviderGitHub
161+
},
162+
wantProviderOptsName: sourcev1.GitProviderGitHub,
163+
},
154164
{
155165
name: "generic provider",
166+
url: "https://example.com/org/repo",
156167
beforeFunc: func(obj *sourcev1.GitRepository) {
157168
obj.Spec.Provider = sourcev1.GitProviderGeneric
158169
},
159170
},
160171
{
161172
name: "no provider",
173+
url: "https://example.com/org/repo",
162174
},
163175
}
164176

@@ -168,7 +180,7 @@ func Test_getAuthOpts_providerAuth(t *testing.T) {
168180

169181
obj := &sourcev1.GitRepository{
170182
Spec: sourcev1.GitRepositorySpec{
171-
URL: "https://dev.azure.com/foo/bar/_git/baz",
183+
URL: tt.url,
172184
},
173185
}
174186

0 commit comments

Comments
 (0)